Skip to content

Version 7.7.0 #316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ildyria merged 2 commits into from
Jul 13, 2026
Merged

Version 7.7.0 #316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5e89a51
Version 7.7.0
ildyria Jul 13, 2026
dc288bd
typos
ildyria Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions src/content/docs/docs/getting-started/releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,53 @@ sidebar:

## Version 7

### v7.7.0

Released on July 13th, 2026

#### Fixes vulnerabilities, bugs and adds a few new features

If we were only fixing vulnerabilities, this would have been a simple patch release. However, we also added a few new features and fixed some bugs: you can now choose which thumb to use as the cover for your tag albums, disable the second line on album thumbs (usually a date), and customize the title and description of the RSS feed. We also fixed two major issues related to group access rights and the propagation algorithm.

Users of the webshop should update to this version as soon as possible, as one of the validation mechanisms was not working properly and could allow for some freebies.

* `new` #4469 : Add option to disable the second line on album thumbs by @ildyria.
> This is a small quality of life improvement, some users requested to have the second line on album thumbs disabled. This is now possible via a setting in the admin panel.
* `new` #4470 : Add cover to tag albums by @ildyria.
> By request, we added the possibility to choose which photo to use as the cover for tag albums. This allows to have a better representation of the tag album.
* `new` #4468 : Make the tags clickable in the photo details by @ildyria.
> By request, we made the tags clickable in the photo details. This allows to quickly navigate to the tag album and see all photos with the same tag. Note that this is only available to logged-in users.
* `new` #4484 : Support 2 lines titles on thumbs with disabled second line by @ildyria.
> When the second line is disabled, the title of albums will be displayed on two lines if necessary.
* `new` #4501 : Allow customizing RSS feed title & description by @cdzombak.
> Our very own @cdzombak added the possibility to customize the title and description of the RSS feed. This allows to have a better representation of the feed in RSS readers.
* `new` #4500 : RSS Feed includes one <item> per photo by @cdzombak.
* `new` #4503 : Add option to configure cache file path by @ildyria.
> A small request, we added the possibility to configure the cache file path. This allows to have a better control on the cache files and avoid potential issues with permissions.
* `fix` #4480 : Update changelog url by @ildyria.
> With the migration to astro Starlight, the changelog url was not updated. This is now fixed.
* `fix` #4481 : Fix propagation error by @ildyria.
> When propagating access rights to sub-albums we were faced with a combinatory explosion. This is now fixed.
* `fix` #4482 : Fixes access rights with multiple groups by @ildyria.
> When a user was part of multiple groups, only the first policy was used to determine the access rights to an album. This is now fixed.
* `fix` #4486 : Fix nsfw warning not being displayed by @ildyria.
> When an album is marked as NSFW, the warning was not displayed on the album page. This is now fixed.
* `fix` #4499 : Fix photos appearing multiple times per-album in RSS feed by @cdzombak.
> Chris also fixed the duplicates presentation in the RSS feed: one photo in multiple albums will now only appear once in the feed.
* `fix` #4507 : Fix dummy validation when processing requests by @ildyria.
> Major vulnerability, @UmutCPP reported that the validation of the requests was not properly done, allowing for some bypasses. This is now fixed.
* `fix` #4510 : Add middleware and caching for docs API by @ildyria.
> The docs API takes a few seconds to generates, an attacker could spam the endpoint and cause a denial of service. We added a middleware to cache the response and avoid this issue. Issue reported by @UmutCPP.
* `fix` #4511 : Avoid large malicious uploads and wasting CPU cycles by @ildyria.
> A malicious user with upload rights could upload a small pdf and cause the server to waste CPU cycles and memory by converting it to a large image. We now limit the size of the uploaded files and avoid this issue. Issue reported by @UmutCPP.
* `klo` #4489 : Fixes HEIC processing in CICD by @ildyria.
* `klo` #4466 : Improve demo workflow by @ildyria.
* `klo` #4512 : Improve Readme by @ildyria.
* `klo` #4508 : Please do not report fopen DNS rebinding issues by @ildyria.

Thanks to @UmutCPP for reporting those three vulnerabilities.


### v7.6.4

Released on June 26th, 2026
Expand Down
1 change: 1 addition & 0 deletions src/data/releases.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ export interface Release {

// Release data extracted from releases.md
export const releases: Release[] = [
{ version: 'v7.7.0', date: 'Jul 13, 2026', title: 'Album thumbs, and RSS feed customization', type: 'feature', highlights: ['Add cover to tag albums', 'Add option to disable the second line on album thumbs', 'Allow customizing RSS feed title & description', 'Fixes access rights with multiple groups', 'Fixes webshop bypass vulnerability (8.3)'] },
{ version: 'v7.6.4', date: 'Jun 26, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a path traversal vulnerability (8.9)'] },
{ version: 'v7.6.3', date: 'Jun 24, 2026', title: 'Hotfix', type: 'security', highlights: ['Fixes a major vulnerability', 'minor fixes'] },
{ version: 'v7.6.2', date: 'Jun 22, 2026', title: 'Hotfix', type: 'bugfix', highlights: ['Revert change to avoid breaking docker installs.'] },
Expand Down
12 changes: 12 additions & 0 deletions src/pages/roadmap.astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -279,6 +279,18 @@ const getReleaseTypeBadge = (type: "major" | "feature" | "enhancement" | "bugfix
Want to contribute? Check out our <a href="https://github.com/LycheeOrg/Lychee" class="text-primary hover:underline">GitHub repository</a>
</p>
</div>

<!-- Release Type Legend -->
<div class="mt-12 pt-8 border-t border-gray-200 dark:border-gray-700 text-left">
<p class="text-sm text-gray-500 dark:text-gray-400 mb-3">What do the release badges mean?</p>
<div class="flex flex-col gap-y-2 text-sm text-gray-600 dark:text-gray-400">
<span><span class={`px-2 py-0.5 rounded-full text-xs font-semibold ${getReleaseTypeBadge('major').class}`}>Major Release</span> — a significant version bringing substantial new features</span>
<span><span class={`px-2 py-0.5 rounded-full text-xs font-semibold ${getReleaseTypeBadge('feature').class}`}>New Feature</span> — a brand-new capability</span>
<span><span class={`px-2 py-0.5 rounded-full text-xs font-semibold ${getReleaseTypeBadge('enhancement').class}`}>Enhancement</span> — an improvement to existing functionality</span>
<span><span class={`px-2 py-0.5 rounded-full text-xs font-semibold ${getReleaseTypeBadge('bugfix').class}`}>Bug Fix</span> — a fix for reported issues</span>
<span><span class={`px-2 py-0.5 rounded-full text-xs font-semibold ${getReleaseTypeBadge('security').class}`}>Security</span> — a patch for a reported vulnerability</span>
Comment thread
ildyria marked this conversation as resolved.
</div>
</div>
</div>
</section>
</Layout>
Expand Down
Loading